0006: One gateway for AI, with consent, limits and no ledger

Status: accepted by the owner (Oct 18, 2026) for the first slice. One OpenAI-compatible adapter serves OpenAI and Groq, chosen by configuration; Groq (whisper-large-v3, openai/gpt-oss-20b) is what it was tested against. The provider is not a final choice.

Context

Two features need an AI service: turning a short voice note into text (so logging is a sentence, not typing), and an assistant that answers plain questions about a person’s own money. Both touch the most sensitive thing the app holds.

Decision

One gateway. All AI goes through AiService in the API, behind a provider interface. No other code names a vendor or a model. Swapping providers means writing one adapter.
Consent first. Nothing is sent until the person has agreed to AI processing. It is checked on every call, can be withdrawn, and is recorded with a version.
The assistant never receives the ledger. It gets the question, with names, phone numbers, emails and long numbers removed, plus five query tools that run on the server and return totals and category names only (no notes, no people paid). The figures come from the database; the model only words the answer.
Voice sends audio, un-stripped, and keeps nothing. Names cannot be removed from speech before transcription. So: consent is required, the recording is held in memory only and never stored, it is size-limited and type-checked, and the transcript is read by our own rules (the same ones used for typed text) so the person always confirms a card before anything is saved.
Limits and cost. A daily limit per person (voice and questions separately) and one usage row per call with its cost.
Calm failures. Every failure has a reason the app can answer in kind words: not switched on, needs agreement, limit reached, helper busy, nothing heard.

Deviations, stated plainly

Speech-to-text and the assistant run inside the request, not on a queue, because there is no queue yet. Short audio, a timeout and the daily limit keep this safe. Move them onto the queue when it exists.
The module’s rule “strip names before every external call” cannot apply to audio. Consent and not storing the recording are the mitigations.

What is proven, and what is not

Proven with a fake provider against a real database: consent gating, limits, cost records, no personal detail in the outbound payload, isolation between people, exact figures. Proven live with Groq (Oct 18): a real question answered with the exact database figure, and a spoken sentence read into the right draft. Not yet proven: how well speech is understood in real Nigerian English and Pidgin: the live test used a clear synthetic voice, so treat accuracy on real voices and accents as unmeasured until real voice notes are tested.